# (L1) Ensure users cannot register applications (L1) Ensure users cannot register applications. A Maester check for Entra ID, User and directory settings. Source: https://maester.dev/docs/tests/CIS.M365.5.1.2.2
Benjamin Metz-Mynster
Contributed by Benjamin Metz with -MynsterAll contributors →

Part of CIS · Entra ID · User and directory settings · All checks

```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.5.1.2.2 ``` ## Overview 5.1.2.2 (L1) Ensure users cannot register applications This setting controls whether standard users can register applications in the Microsoft Entra ID directory. When enabled, any user can create app registrations, which function as identity objects for applications. #### Rationale Allowing standard users to create app registrations expands the tenant's attack surface. A compromised account or malicious insider could create a rogue app registration to establish a persistent OAuth client, facilitate token theft, or impersonate a legitimate application. Restricting app registration to privileged roles ensures that new application identities in the directory are subject to administrative review and approval before they can be granted permissions to organizational resources. #### Impact End users will no longer be able to register applications independently, including both third-party integrations and custom applications. Developers and IT staff who create app registrations as part of normal workflows will be affected and will need to submit registration requests to a privileged administrator (e.g., Application Administrator or Cloud Application Administrator). Organizations should establish a formal request and approval process before implementing this change to avoid workflow disruption. #### Remediation action 1. Navigate to [Microsoft 365 Entra admin center](https://entra.microsoft.com). 2. Click to expand **Entra ID** > **Users** select **Users settings**. 3. Set **Users can register applications** to **No**. 4. Click **Save**. ##### PowerShell 1. Connect to Microsoft Graph using `Connect-MgGraph -Scopes "Policy.ReadWrite.Authorization"` 2. Run the following commands: ```powershell $param = @{ AllowedToCreateApps = $false } Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions $param ``` #### Related links * [Microsoft 365 Entra admin center](https://entra.microsoft.com) * [How and why applications are added to Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/how-applications-are-added) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 197](https://www.cisecurity.org/benchmark/microsoft_365) ## Details
Every attribute of this check | Field | Value | | --- | --- | | Test ID | CIS.M365.5.1.2.2 | | Severity | Medium | | Suite | CIS | | Product | Entra ID | | Feature | User and directory settings | | Area | Applications and workload identities | | Resource type | Tenant | | User impact | Low | | Implementation cost | Low | | MITRE ATT&CK | T1098.001 Additional Cloud Credentials, T1528 Steal Application Access Token | | Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.1.2.2 | | Benchmark level | L1 | | Benchmark profiles | E3 Level 1, E5 Level 1 | | Supports controls | cis-m365:5.1.2.2, nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5 | | PowerShell test | [Test-MtCisThirdPartyApplicationsDisallowed](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.2.2.ps1) | | Services | Graph |
## Source - Test: [`tests/cis/Test.CIS.M365.5.1.2.2.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.2.2.ps1) - Documentation: [`tests/cis/Test.CIS.M365.5.1.2.2.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.1.2.2.md)